Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length The Read Local Codec Capabilities function returns a sequence of capability elements. Each element begins with a one-byte length followed by that many payload bytes...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix advertising data UAFs hcifindadvinstance returns an advinfo pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in some...

esp32-cve-2025-27840-power-trace-experiment

esp32-cve-2025-27840-power-trace-experiment Firmware for getting a power trace of the behavior of the bluetooth module on the ESP32 when the ESP32 is sent the undocumented hci bluetooth commands CVE-2025-27840. When the ESP32 receives the commands, it toggles a GPIO pin to trigger the power trace...

CVE-2020-0022

CVE-2020-0022 Seems like Android 9-6 have similar Bluetooth subsystem, Android 5 and 4 are different. Android 9.0 BlueFrag experiments Patch: https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf Below I hit the patched condition. OK I think I got it, but...

Linux Distros Unpatched Vulnerability : CVE-2026-79982

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB...

UBUNTU-CVE-2026-79982

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

CVE-2026-79982

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

CVE-2026-79982

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

CVE-2026-79982

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

EUVD-2026-109145

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

CVE-2026-79982 Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

CVE-2026-79982

The Bluetooth HCI USB transport class in subsys/usb/device_next/class/bt_hci.c contains an out-of-bounds write vulnerability. The bt_hci_tx_sync_in() function allocates a buffer from bt_hci_ep_pool (fixed at 64 bytes on full-speed-only builds) and uses net_buf_add_mem() to copy controller-to-host...

CVE-2026-79982 Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

CVE-2026-79982 Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions from 6.6.28 up to and including 6.6.160, as well as in version 6.8.7 through 6.9. This vulnerability stems from improper handling of the lifecycle of command SKBs during Bluetooth HCI synchronization. In hcilesetextscanparamsync, the addres...

PT-2026-122216

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device next/class/bt hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt hci tx sync in allocated that buffer from bt hci ep pool, a fixed pool whose slots...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fixed memory leak in the error path of hciallocdev Early failures in Bluetooth HCI UART configuration lead to SRCU percpu memory leaks. When device initialization fails prior to completion of hciregisterdev, the...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.6 contains security vulnerabilities. These vulnerabilities stem from improper handling of CIS hold ownership in Bluetooth HCI connections, which may lead to an imbalance in reference counting...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcildisc,serdev: failure in checking percpuinitrwsem syzbot reports a NULL pointer dereferencing at hciuartttyclose 1. For rcusyncenter, percpuinitrwsem is called without rcusyncinit, because hciuartttyopen ignores...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Fix driver shutdown on closed serdev The driver shutdown callback which sends EDLSOCRESET to the device via serdev should not be invoked when the HCI device is not open e.g., if hcidevopensync failed, since bot...